Posted
by
Unknown Lamer
on Wednesday February 19, 2014 @10:12AM
from the but-it's-a-firewall dept.

Nerval's Lobster writes "The remote-access management flaw that allowed TheMoon worm to thrive on Linksys routers is far from the only vulnerability in that particular brand of hardware, though it might be simpler to call all home-based wireless routers gaping holes of insecurity than to list all the flaws in those of just one vendor. An even longer list of Linksys (and Cisco and Netgear) routers were identified in January as having a backdoor built into the original versions of their firmware in 2005 and never taken out. Serious as those flaws are, they don't compare to the list of vulnerabilities resulting from an impossibly complex mesh of sophisticated network services that make nearly every router aimed at homes or small offices an easy target for attack, according to network-security penetration- and testing services. For example, wireless routers (especially home routers owned by technically challenged consumers) are riddled with security holes stemming from design goals that emphasize usability over security, which often puts consumers at risk from malware or attacks on devices they don't know how to monitor, but through which flow all their personal and financial information via links to online banking, entertainment, credit cards and even direct connections to their work networks, according to a condemnation of the Home Network Administration Protocol from Tenable Network Security. Meanwhile, a January 2013 study from Rapid7 found 40 million to 50 million network-enabled devices, including nearly all home routers, were vulnerable to exploits using UPnP. Is there any way to fix this target-rich environment?"
If only there were an easily upgradeable open source router operating system to which vendors could add support for their hardware leaving long term maintenance to a larger community.

If you have a home router, is it protected if it is behind the router built into many DSL or Cable modems? Your ISP may be protecting your firewall router by placing it behind another firewall router in your modem.

A quick test to see if this may apply to you. view your router's status page and look at the IP address of the WAN connection. If the WAN connection is a 196.168.x.x number then your modem has a router too. Has anyone pen tested your modem router?

Some devices may indeed be behind carrier NAT and be assigned RFC 1918 addresses. But that's more likely for mobile connections, and very unlikely for home DSL/cable ones - it would break all sorts of things because you have no control over inbound NAT.

Also, you most certainly meant "192.168...". 196.168.x.x are public IP addresses. If a carrier were to use private IP space, they'd be much more likely to use 10. addresses.

First you have to find the right build of DD-WRT. This involves totally ignoring the router database, which, as one person's website put it, is either massively out of date at best, and *WRONG* at worst, liable to brick your router.

And if you join the support forum, you discover people talking about their "favorite" builds, something in over 30 years in the field I've *NEVER* heard of. And they don't have formal releases, and regression tests seem to be mostly dependent upon the lead developers.

Two months of fighting this, and debricking my router 2? 3? times, and I found one that did what I needed (that was to actually serve as a print server for a USB printer, as well as routing).. I have no idea how, or if, I'll be able to upgrade.....

Two months of fighting this, and debricking my router 2? 3? times, and I found one that did what I needed (that was to actually serve as a print server for a USB printer, as well as routing).. I have no idea how, or if, I'll be able to upgrade.....

Is there any penetration testing or statistics that suggests that dd-wrt and the likes are more secure, or is this an it-runs-Linux-so-it-must-be-good knee-jerk assumption?

I used to run dd-wrt on a router some years ago and liked it feature-wise and performance-wise. However, my confidence in its security took a pretty big hit when I read about this gaping security hole [cxsecurity.com] in 2009. It's the kind of issue that makes you doubt that some of the developers really know what they are doing.

I have PFSense running on a virtual server, which I recommend to anyone. Perhaps not on the virtual server... it kind of adds a layer of complication that most people probably wouldn't care for, but it works well enough.

I really liked pfSense but when I used it long ago it was very buggy. It may be time for me to give it another try. However, if you're familiar with the Cisco IOS CLI, Vyatta is another solution. I plan to set up a small low power box to be my router and only use my Linksys Router/AP combo (flashed with DD-WRT) as an access point. It gives you far more options in terms of management, and if you happen to seed a lot of Linux ISOs you don't have to worry about filling up the memory with the routing table.

There's a learning curve with Vyatta but once you catch on it's pretty easy. There's also plenty of guides online that'll get you started and a very friendly community.

I didn't like the web interface of pfSense, and at the time of using it I was still pretty green with the Linux CLI so using that wasn't as much of an option. From what I can see there have been improvements, plus it's also been 7~ years since I used it, so I might give it a shot in a VM.

I bet everyone is busy writing smug comments about closed source firmwares, but let's not forget that DD-WRT have had a similar bug. http://www.xtremesystems.org/forums/showthread.php?230880-Massive-DD-WRT-Security-Hole-%28Unauthenticated-Root-Control-Possible%29

I don't actually know if it matters or not but I prefer Apple over other wireless routers because it's so damn braindead easy to keep them patched. Apple just pushes out firmware updates (rarely). Every other router I've owned it was a struggle to figure out if it needed a patch, how to do it. Moreover it was a source of worry even when there wasn't a problem which alone was worth any relatively small cost differential.

Eh, to be fair, this is something they are doing right and a lot of manufacturers are not. Techie types sometimes freak out over being automatically patched with who knows what, but for the vast majority of users (including techie types), it is a good strategy.

And number of techie types that actually manage consumer grade routers for businesses, I would guess, is an extremely small cross section of techie types. Most businesses that actually employ a technician probably use at least something along the lines of a Juniper SRX as the public router. The point still stands, that automatic firewall updates is a good idea for the vast majority of consumers and techie types (just not in their professional arena).
I must confess, that I have been using the Apple base

You realize, of course, that you don't have to update. It just notifies you. I like that little feature of the Apple routers (and OS X and iOS). Given that Apple, like every other vendor on this planet at least, pushes out updates that occasionally break things (Hi Microsoft!), I don't upgrade the moment the patch is available. I wait a week or so unless there is some overwhelming reason like some nasty exploit.

Yes, it's not perfect. No, nobody is perfect. As has been mentioned on this thread and coun

I feel that all those links to WRT/PFSense/M0N0Wall/Tomato/etc are kind of redundant.Sufficient to understand, that the underlying concept of UPnP is an abomination; a sick and distorted concept that deserves nothing less than an immediate death sentence, and to be buried along with The Funniest Joke In The World; never to be resurrected again.

Sufficient to understand, that the underlying concept of UPnP is an abomination; a sick and distorted concept that deserves nothing less than an immediate death sentence, and to be buried along with The Funniest Joke In The World; never to be resurrected again.

So how do you propose that my game on a machine on NAT arranges to receive UDP through the firewall? I'm supposed to manually configure firewall rules for each game? And then change them all if my IP changes?

In my area, 15 minutes from the closest city which has about 60.000 inhabitants, I have about 20 providers competing on fiber, cable and copper. You can also toss in a few 4g providers that sell broadband you can carry around.I settled for fiber 100/100 with tv and phone for $100 a month. It's not the cheapest, but I'm hooked on the speed:)They also provide ipv6 and "bridge mode routers" with a fixed ipv4 address for my own router and a/62 ipv6 prefix.

We used to have a public telephone company called Telenor, but after it became private it came with the catch that all competitors can buy capacity from them at cost + investment write-offs. It's been working wonders.

Well, speaking on behalf of other posters here - you are probably supposed to spend all of your time configuring some linuxy version of iptables or some such on a custom router. Then you won't have to worry because you won't have time to play your game...

So how do you propose that my game on a machine on NAT arranges to receive UDP through the firewall?

So go for convenience over security. But don't then complain when you install VNC on your PC and it automatically opens a port allowing everyone on the Internet to access it, and you didn't bother to set a password so your PC is now pwned by the first script kiddy who scans your router.

UPnP is simply insane from a security standpoint. Random applications should not be opening random ports without explicit permission.

Mod parent up. UPnP is insecure by design. It's very purpose is to take security and control out of the hands of the user, and put it squarely in the hands of whatever happens to be running on your network.

It's too bad that most people don't understand enough about network security to configure their own router, and a double shame that the kludge we call NAT has further broken network applications, but convenient "workarounds" like UPnP could only ever lead to problems like the summary lays out.

So go for convenience over security. But don't then complain when you install VNC on your PC and it automatically opens a port allowing everyone on the Internet to access it, and you didn't bother to set a password so your PC is now pwned by the first script kiddy who scans your router.

You don't know me very well. If I am to remote into Windows I use RDP, and if I permit it at all it's only to the local network. And for all my statements that network transparency is irrelevant to most X users, if I want to remote Unix, I'll use an ssh tunnel. Sure, uPnP is a minefield for novices. But for me, it's immensely useful. Also, on Windows XP or later, VNC won't just magically open up your machine. Windows will ask you if you want to permit network connections to VNC, and it's up to you to decide

While your logic looks okay at a first glance, it doesn't at a second.

When a government has thousands of enraged citizens running towards the government building to set those on fire and loot them, some machine guns might be the means of choice. Though it ought to have been considered by the government du jour, what the reaction of the public will be, with the introduction of strict austerity measures, as well as jus primae noctis?

There is no fundamental reason, really, to have 1000 games opening 1000 diffe

There is no fundamental reason, really, to have 1000 games opening 1000 different ports for endless protocols on a home router.

In a perfect world, all of those games would communicate using the best possible protocol, and all communications would be cleared through a central facility. Problem is, "best" can be defined in many ways. Thus, we have all games using the same underlying protocol, but then building protocol on top of protocol in order to carry out their communications in the way that makes the most sense to the developers (or whoever drew up the architecture at the time, which might have been a schizophrenic hive-mind of

Sufficient to understand, that the underlying concept of UPnP is an abomination; a sick and distorted concept that deserves nothing less than an immediate death sentence, and to be buried along with The Funniest Joke In The World; never to be resurrected again.

So how do you propose that my game on a machine on NAT arranges to receive UDP through the firewall? I'm supposed to manually configure firewall rules for each game? And then change them all if my IP changes?

I play a lot of online games. I have had UPnP disabled on every network gateway I've owned precisely because it is ridiculously insecure. I have yet to find one that doesn't work properly with UPnP disabled.
The only exception to this is when I was running a CS:GO server awhile back I had create port forwarding rules so clients could connect, but setting up dedicated servers on residential networks isn't something non-advanced users do.

NAT should setup a rule to allow your machine to get packets as long as you send some packets there first. Unless your game machine is acting as a game server and getting packets from many host, it should just work. Otherwise, you could/should setup a port forward to your internal machine.

I think that programmers are going to assume they can talk to the remote host, and then timeout/fallback when that communication fails to take place correctly. If you are going to connect to a server either with tcp or udp, you are going to do a gethostbyname and then send a packet. The NAT appliance is going to see the packets and set up its translation table so that outgoing packets get re-written with the correct source address/port. And the incoming packets from the dest/port are going to get re-w

Use static DHCP on your DHCP server and a UDP port forward. Your IP won't change (due to static DHCP which always gives the same IP address to a given Ethernet address) so it should never need to be updated. This is pretty straight forward with Tomato firmware.

What is the problem with UPnp??? From what I understand, UPnP works like this:

1) All devices inside the local network are considered "trusted"

2) Trusted devices can poke holes in the firewall pointing only back to themselves.

Assuming that UPnP is implemented properly, and assuming that an attacker is on the outside of the local network, there is nothing for an attacker to grab on to. Now, if an attacker is on the INSIDE of your LAN, then you are already boned.

Again, used to be that the most common way for a Ubuntu machine to get pwned was for the user to install VNC with UPnP enabled. They only wanted to connect over their LAN, but VNC went and opened a UPnP port, and... oops.

Yes, this is/. We can upgrade our router firmware or install other firmware. Joe Sixpack cannot.

The blame for this should be laid squarely at the feet of the router manufacturers. IMHO, here's what Linksys/Cisco/Netgear/etc/etc/etc/ should do, at the very least:

1. Be open and forthcoming about bugs found in their router software2. By default, routers should ship with automatic firmware updates enabled. This should be difficult to disable and robust enough that it'll *just work* with no user intervention.3. Tell this to their customers in plain English or $localLanguage on the product packaging. And NOT in fine print. Make it very obviously noticeable to the purchaser. This can and should be a signifiant selling point, really. If I'm at BestBuy/WalMart/etc. and see one router boldly telling me "We care about your security! To protect you and your data, this router will check weekly with $manufacturer and update itself to give you the most secure Internet experience possible." And it's sitting next to another router that says no such thing, I'd buy the one that will keep me safe.

By default, routers should ship with automatic firmware updates enabled. This should be difficult to disable and robust enough that it'll *just work* with no user intervention.

The problem is that this kind of automatic update process can be a security hole in and of itself. If there is a way for a remote system to send updates to the router's firmware, then there is the potential for a malicious user to spoof the update and send their own custom-crafted exploit code.

The problem is that this kind of automatic update process can be a security hole in and of itself. If there is a way for a remote system to send updates to the router's firmware, then there is the potential for a malicious user to spoof the update and send their own custom-crafted exploit code.

The blame for this should be laid squarely at the feet of the router manufacturers.

Ok, what good is that going to do? So a bunch of people get their home routers hacked, and you point the finger at the router mfgrs. Why should they care? What are you going to do about it? Declare that you're not going to buy from them any more? Haha, like they care; their customer base isn't Slashdot users, it's regular Joe Schmoes who don't read Slashdot or tech news, and just buy whatever the Best Buy salesman or Com

That's right. Installing an OpenWRT release made for a D-Link DIR 825 on a Linksys E3200 would be a bad thing. So would installing the official D-Link firmware.

If both manufacturers were to produce updates their own hardware, instead of kicking a device to the curb and then never releasing an update again until they receive a court order requiring them to, then this wouldn't be a problem.

If both manufacturers were to produce updates their own hardware, instead of kicking a device to the curb and then never releasing an update again until they receive a court order requiring them to, then this wouldn't be a problem.

And if ethereal unicorns would shit gold bricks in my back yard, I'd be able to buy a new car.

But out here in the real world, routers are commodity appliances with a support lifetime measured in months, and you certainly can't sanely expect vendors to kneecap their cashflows by

Problem is that they also are the biggest boon to computer security since the network was invented. I look back with less than fond memories of having my mother's windows box connected directly to the internet w/o any kind of firewall or even a NAT between her and the wild west. Oh those where the days!

I'd much rather have even a flawed router between her machine and the bad guys. Even if they can compromise the router, that's at least one more step they have to go though, making her lowly Windows' box

I resisted wireless as long as I could because of this very issue. I can turn on my computer and see a dozen networks, and I live in the suburbs. Unfortunately, convenience and devices I wanted to use finally required it (can't use an iPad without wireless), so I caved a few years ago. Thankfully, I learned long, long a go that if I didn't want something on the Internet, I didn't let it near an Internet connected computer. I have an old laptop I use for personal things that is not connected to any inter

Which is one of the reasons that I treat wireless networks as hostile in my home, and you have to log in via VPN even if you're connected to my wireless.

It's not hard. If you don't trust wireless, and you don't trust the Internet, treat them as the same thing.

I've gamed and accessed my home network using OpenVPN on every client (over wireless and remote) for as long as I've had wireless. No extra ping on any half-decent hardware, utter security and who cares if - as in my case - WEP is flawed and then rep

You sound totally paranoid. If you want to be quite reasonably secure and have WiFi, all you have to do is make sure you're using WPA2 encryption. Better yet, make sure you're using an alternative firmware like OpenWRT or DD-WRT, and keep WPS and uPnP off no matter what you use.

I don't think I've even heard of someone getting their WiFi hacked when WPA or WPA2 was being used; people only get their home WiFi "hacked" when they either use no security whatsoever, or WEP (WEP is trivial to hack). And even th

Don't forget to hard disable the microphone on the laptop if it has one. There is a malware that can communicate using high frequency sound, from a networked machine to un-networked one. Of course both machines have to be infected. Probably with a virus attached to a file of the networked box.

I wonder why usability was able to sell more than security? Hmm. Let's think about that.

Meanwhile, a January 2013 study from Rapid7 found 40 million to 50 million network-enabled devices, including nearly all home routers, were vulnerable to exploits using UPnP.

Man, and I can't get my home router to do UPnP. It's bad that UPnP allows for the configuration of the router to come from a machine outside of the network, but that should get fixed and UPnP should be able to start behaving like it is designed to.

Man, and I can't get my home router to do UPnP. It's bad that UPnP allows for the configuration of the router to come from a machine outside of the network, but that should get fixed and UPnP should be able to start behaving like it is designed to.

Considering UPnP is broken by design, that's not really an improvement. Replacing a security hole in the router by a hundred apps that want their own ports to expose their own security holes to the Internet doesn't help much.

Commercial, closed-source products just tend to have these problems and it's pie-in-the-sky to wish for a vendor to produce a secure product. If you want it secure, probably your best bet is an open source, open hardware mini server (like cubieboard or Raspberry Pi) and you're going to have to learn to do it yourself.

After I found that my ASUS RT-15U was running telnet with a default password, open to the world which I couldn't kill or change the password on, I swore of embedded device routers.

I have replaced it with a small Debian box with dual NICS, and bought a 24port switch from TPLINK. It was the best decision I have ever made. Perfect reliability, complete control, via IPTABLES. I've got auto blocking of malicious ips trying to hit my ssh or port scanning me via DenyHosts and PSAD.

A couple other custom scripts and DNSMASQ, dhclient, snort, and python, and I have all the other services and features I want, and ONLY the services and features I want.

The default password, when it is the same default password across all units of the same model or even the same manufacturer, is easy to exploit. Any website can send the user's browser some code that instructs it to attempt to log in via the user's router's web interface with the default password. It works because the user's browser is behind the firewall and therefore "trusted". Once logged in, it's trivial to reconfigure the router to open up all kinds of holes. Harder but still doable is getting the router to host and run malware itself.

The admin password is the first thing I change on a new router. Manufacturers who still don't individualize the factory set password are responsible for a lot of these problems.

Even better, print it in one location, then hot-stamp it into the plastic of the router's case, filling the indentation left by the letters with an self-curing epoxy (so the stamped password doesn't wear away over time). It won't be 100%, but at least if the sticker wears off, the password is still present. Another way is to have a sticker, then a metal tag that gets stamped by a press, and is attached securely in a recessed place on the case (so if the glue fails over time, the tag doesn't fall off.)

If only there were an easily upgradeable open source router operating system to which vendors could add support for their hardware leaving long term maintenance to a larger community.

If only it supported routers with built-in ADSL (which was the dealbreaker last time I looked at DD-WRT - and it took me some digging to discover that was why none of the routers I wanted to use it on).

If that's since been fixed - and supports a router I can actually buy somewhere - then mod me happy.

Personally, I could put together a low-power Linux box, get an ADSL modem, an ethernet switch, wireless access point (sounds like Belinksysco crap would be just as big a liability in WAP-only or modem-only mo

So this article is saying that routers are *bad* things for security right? Not so fast...

In my view, having a router, even an imperfect one, between you and the internet is a *GOOD* thing for security. Yes, routers might be security risks, but NOT having them is even WORSE of a risk.

Does *anybody* out there remember what it used to be like? It wasn't that long ago that the standard internet connection was for ONE machine and used a PPP connection that pretty much put your Windows (mostly) box directly on the internet. When all this got started, we didn't even have software firewalls. Imagine having a windows 95 box with all the standard services on a routeable IP address. It WAS extremely risky. I remember having unsolicited popups coming up all the time and bothering me with all manner of advertisements. It was a mess and security was extremely lacking.

But then we have the dawn of consumer's using routers and doing all the same exploits became harder because of the NAT. Then routers added stateless firewalls, then state-full firewalls and closed many of the avenues used by the "bad guys" to gain control of your system.

Consumer grade routers have been a HUGE boon to network security in the consumer world. Do they have flaws? Many do, but their contribution to overall security is worth more to me than the risks they may pose. Give me a router, even a flawed one, over nothing. Making the bad guys work harder is a good thing for security, and a flawed router does that.

It's not that we shouldn't be discussing how routers should be made more secure. Obviously we want them to improve. It's just that we cannot loose sight of how far we've come BECAUSE of these things.

What is the one thing worse than having a Bot on your desktop machine? Having a stealth Bot controlling your network, having access to all your hosts, playing man-in-the-middle for all your "secure" SSL/TLS banking and credit-card connections. Andy you have no clue that it is even there. At least when you get a Bot on your local desktop machine you will have clues that something is spinning CPU and taking up disk space, if you are smart enough to notice those things. When a bot controls and sees everything,

the biggest security threat to computers is the user. users improperly configure things, wont take security precautions (like using weak passwords) and will outright download viruses/malware. far too many users are not competent enough to tell the difference of a real popup window and a website claiming they have a virus and they need to install their trojan horse immediately.

I seriously doubt that Belkin will put out firmware updates for all the old $50 Linksys router models they inherited support for--instead opting to push users to buy replacement models they otherwise wouldn't need. The likely answer is NO--even with a class-action lawsuit. (In all actuality, a 2006-era 2.4GHz 802.11G WPA2 router is still more than plenty for the crappy broadband speeds available in North America...)

This is what scares me about the Internet of Things when it comes to long-life appliances that you could own/use for decades... How long will manufacturers (many of whom have 0 experience so far with connecting their products to anything but a power cable) continue to support these devices? Ultimately, government regulation may be required in this space. God knows I wouldn't want my IoT refrigerator to get "bricked" (a really heavy, big brick!) after 20 years because the manufacturer went under & the fridge couldn't phone home... Or worse, because someone found a backdoor that had been in place for all models in use for 9 years before my model was developed...

This sort of issue is why the Free Software Foundation was created. It wasn't because Stallman had some kind of political agenda, it's because he wanted to fix the driver for his printer, but couldn't because it was proprietary. The "Internet of Things" has the exact same problem, and the exact same solution.

there are options for more secure but they fight the hardware hackers instead of embracing them. If they would reach out to the communities and work with them or PAY these groups like OpenWRT to write their firmware they would end up with a better product.